Wireshark-bugs: [Wireshark-bugs] [Bug 11452] Capinfos crashes on pcap-ng files with no IDBs
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 19 Aug 2015 19:52:45 +0000

Comment # 4 on bug 11452 from 
(In reply to Guy Harris from comment #3)
> (In reply to Hadriel Kaplan from comment #1)
> > It's not really a crash - it failed an assertion, and apparently the
> > assertion revealed a bug in the wiretap PCAPNG file reader. The file reader
> > is successfully opening a PCAPNG file without any IDBs, even though that
> > should make it a malformed file and it should error when opening it.
> 
> Nope.
> 
> A pcap-ng file with packet blocks or other blocks that refer to interfaces
> for which there's no IDB is malformed, but a pcap-ng file with no IDBs and
> no blocks that refer to interfaces is, while probably somewhat trivial and
> uninteresting, isn't malformed.

I was originally going to ask on the pcapng list about whether an "empty"
pcapng file could legitimately not have an IDB, because I was wondering about
that scenario as well. But reading the draft it says the IDB is mandatory, and
gives no such wiggle room for empty files. (i.e., files without any packet
blocks)

So are you saying the draft should be changed? I'm cool with that - I don't
care which it is, I just need to know so I can fix the bug one way or the
other.

You are receiving this mail because:
  • You are watching all bug changes.